fix workflow edits repo source beyond dependency files (subverts repo policy)

[toufali]

On a Dependabot PR in mozilla/fxa (postcss), the fix-dependabot-pr workflow committed a change to a non-dependency source file to make BLEnder's own CI pass:

• Commit: mozilla/fxa@bd91a6d
• Our response on the PR: chore(deps): bump postcss from 8.5.12 to 8.5.23 fxa#20923 (comment)

It rewrote _scripts/check-node-version.sh, loosening fxa's intentional exact-Node guard to a ^ range. Problems:

1. Scope creep. A dependency bump shouldn't edit unrelated repo source — only manifests/lockfiles.
2. Overrides repo policy. fxa deliberately enforces an exact Node version. The right fix for BLEnder's runner using the wrong Node is the node_version config pin (which exists), not weakening the repo's guard.
3. Drags in code-owner review. The edited script is code-owned, so the otherwise CODEOWNERS-exempt dep PR became REVIEW_REQUIRED / blocked.
4. Strips the executable bit. The commit (via GitHub contents API) changed 100755 → 100644; a maintainer had to restore it by hand (mozilla/fxa@6567934).
5. It acted on a dependency BLEnder itself had judged not affected.

Suggestion: constrain the fix workflow to dependency/lock files (package manifests + lockfiles) and refuse edits outside them, and preserve file mode on commits.